In Depth

Information Destruction: Trash Talk

The decidedly unsexy topic of information destruction got very scintillating a couple of years back when the Enron debacle hit the front pages.

By Todd Datz

November 01, 2004 — CSO — The decidedly unsexy topic of information destruction got very scintillating a couple of years back when the Enron debacle hit the front pages. Arthur Andersen, Enron's auditor, eventually dissolved, partly because its folks held some shredding parties after learning the government was investigating their client. (A joke making the e-mail rounds at the time, based on those ubiquitous Sprint PCS commercials: "The Andersen partner said, 'Ship the Enron documents to the feds,' but the secretary heard, 'Rip the Enron documents to shreds.'")

The Andersen case is a poster child for why companies need to have good information destruction policies in place. Some of the major reasons include: Companies might need to produce records as part of an investigation; companies need to protect the privacy of their employees and customers; and companies need to protect intellectual property. (Industrial espionage professionals consider Dumpster diving one of the best means to obtain confidential information about companies.)

To the casual observer, ripping off a competitor's trade secrets by rummaging through the trash seems illegal (and disgusting to boot). But its not. In a 1988 case, the Supreme Court ruled in California v. Greenwood that Americans' trash is not private, that its open and available to whomever wants to pick through it. In addition, the Economic Espionage Act of 1996, which made it a federal offense to steal trade information, won't protect a company that fails to use reasonable measures to protect its information.

The information destruction industry has changed dramatically in the past two decades. "In the early 1980s, the only alternative to do a good job was to do it in-house," says Robert Johnson, executive director of the National Association for Information Destruction (NAID). A few companies, such as AT&T and IBM, had large-scale destruction facilities, he says. Over time, those companies began to outsource destruction services as the industry spawned new contractors and organizations eager to serve companies' needs. Many NAID members today have impressive destruction facilities that could pass for prisons or army facilities, says Johnson. There are also sophisticated, $250,000 mobile destruction trucks that service companies and can shred 6,000 pounds of paper in an hour.

Johnson says that, in general, most midsize to large companies now have fairly good policies in place; that's partly a response to HIPAA, Gramm-Leach-Bliley, Sarbanes-Oxley and the growing problem of identity theft. But most companies have room for improvement. One of the most important things a company can do is shred documents in a consistent manner, says Johnson. "You need to shred everything; it's suspicious if youve done one class of records and not another," he says. Documents should also be destroyed on a regular schedule. (The out-of-the-ordinary 11 p.m. shredding bash in the conference room isnt going to look good in court.) Johnson also advises that companies remove employee discretion; that is, employees should only be able to access corporate information on a need-to-know basis. And make sure collection equipment for confidential information (separate from waste cans) is conveniently located, and information is disposed of daily.